Skip to content
countermade

Taking a card by phone in Shopify: key it in or send a link

Updated · 6 min read
By Invenire Studios, makers of Countermade

The short answer

Shopify gives you two ways to take a caller’s card: staff key it in, or you send a checkout link and the customer types it in. Shopify warns that manual card entry “carries additional fraud risk” and, for telephone orders, says to “consider sending a draft-order invoice”. Send the link by default and key the card only when you must.

Compared Staff key in the card Customer pays by link
Who types the card Your staff, as the caller reads it out The customer, on their own phone or computer
Where the number goes Read aloud and typed by staff, sometimes written down first Straight into Shopify’s checkout
Cardholder check A matching security code doesn’t prove the caller holds the card, “because criminals can steal the code too” Supported cards can use 3D Secure at checkout
Who generally carries fraud losses You You, unless an eligible authenticated payment shifts liability to the card issuer
What you need In POS: a provider and device that support manual entry, and an internet connection (it doesn’t work offline). In the admin: Shopify Payments, once its verification is complete. No card reader either way. A way to reach the customer: email or a message app
When the card is charged During the call When the customer completes checkout

How to key in a card in Shopify

In Shopify POS

  1. Add the items to the cart, then tap Checkout.
  2. Tap Manual card entry, enter the card details and tap Charge.
  3. Print a receipt if you want one, then tap Done.

If Manual card entry is missing, the device may be offline, the option may be off (see below), or your provider may not support it.

On a draft order in the Shopify admin (Shopify Payments only)

  1. Open the draft under Orders > Drafts, or click Create order for a new one.
  2. In the draft’s Payment section, click Collect payment, then Credit card.
  3. Enter the customer’s billing and card information.
  4. Click Charge. Shopify turns the draft into an order.

What changes when your staff type the card

It’s card-not-present, even at the counter. Shopify treats every manually entered payment as card-not-present “even when the customer is in your store”, so what follows applies at the register too. Shopify Payments also charges keyed payments at a different rate from in-person ones; check the rates for your region, or your provider’s.

Fraud losses generally land on you. In a dispute, you must prove the sale was legitimate. A chargeback takes the disputed amount from you right away, and Shopify Payments adds a chargeback fee (US$15 in the US, for example) that you get back if you win.

The number has passed through your staff. The card industry’s data security standard applies to any business that handles card data, even once. Shopify’s certification against that standard covers your store and its shopping cart. A number on a notepad by the register is outside it.

A link moves the typing to the customer, but it’s still card-not-present, so chargebacks can happen. The full workflow is in how to take phone orders on Shopify without asking for card details. In brief:

Draft-order invoice from the admin. On the draft (opened as above), click Send invoice, add a message, then click Review invoice > Send invoice. To text it, use Share > Copy link instead (how to send a Shopify payment link by text).

From Shopify POS Pro. In the ⋯ (More actions) menu at the top of the cart, tap Send cart to email the cart, or tap Create draft order, find it under the Order icon > Drafts (or Load Drafts) and tap Email to customer in its menu. Either way, the order waits as a draft until the customer pays.

Quick Sale in the Shopify app (not Shopify POS). Add the items to a Quick Sale, tap Collect > Payment link, then Share link and pick the app to send it with.

Shopify payment links explained covers where each route’s order shows up. Two things trip stores up:

  • Checkout asks the customer to choose shipping. For a pickup, turn on Pickup in store for your location (Settings > Shipping and delivery), then choose it on the draft in the admin with Add shipping or delivery before sending; checkout can’t change it. Set shipping on a Quick Sale link before sharing it, and test a Send cart checkout, since its shipping options aren’t documented.
  • Don’t mark a draft Paid early. The invoice link stops working and the customer can’t check out.

When keying the card is still reasonable

A caller with a landline and no email or smartphone can’t open a link. At the counter, Shopify also points to keying when you have no card reader or it isn’t working; when it works, Shopify’s advice is chip or contactless. If a phone customer will pay when they pick up, take the card on the reader then; trade counters have more options (phone orders at a Shopify trade counter).

If you do key a card, Shopify should be the only place the number goes. Train staff to:

  • Type it straight into Shopify while the customer is on the line.
  • Never write it on paper, in a spreadsheet, in order notes or in an email.
  • Never repeat it aloud or record calls that include it.
  • Never keep the security code after the payment goes through.

If card details end up on paper or in a call recording anyway, restrict who can reach them.

Turn off manual card entry on devices that don’t need it

On each device, in Shopify POS, go to Settings > Payments > Payment options and turn off Allow manual credit card entry.

Shopify’s chargeback advice, which calls the switch Allow manual card entry (MOTO), recommends exactly this. Store-wide defaults are set from the Point of Sale channel in your admin. A device can switch off an option the default allows but can’t switch on one the default leaves out, so check each device rather than assume manual entry is off.

Changing it needs a role with access to the Shopify admin and Point of Sale, plus the Manage payment settings for device permission; keep that with managers. Leave manual entry on only where there’s a reason, such as the manager’s iPad for when the reader fails.

Keying in the admin is governed instead by the Charge credit card staff permission (under both Draft orders and Orders), so give it only to people who need it.

Pay Link, from Countermade (the Shopify POS apps from Invenire Studios), is for POS Pro stores that take phone orders and want every caller paying by link, not reading out a card. It makes the payment link from the POS cart, where staff already build the order. The customer pays on Shopify’s own secure checkout, so staff never see or type card details. It also adds three safeguards around the link:

  • Staff see the total before the link goes out, with a note when shipping will be added at checkout.
  • A double tap makes one payment link, not two.
  • Staff can see whether a link has been paid.

Checkout asks the customer for a delivery address and may add shipping, so turn on Pickup in store (above) and the customer can choose pickup.

Like any payment link, it changes who types the card, not the chargeback rules. Shopify POS payment links: native options vs Pay Link sets it beside Shopify’s own options.

Next step

Before the next phone order comes in, check who holds the Charge credit card permission in the admin and switch manual card entry off where it isn’t needed. Then send that caller an invoice instead of taking their card number.

If you want links made from the POS cart with the total shown up front, join early access and we’ll email you when Pay Link is ready for your store.

Used only to email you when the app is ready to try. See our privacy notice.

Thanks. You’re on the list, and we’ll email you when Pay Link is ready to try.

Common questions

Can I take a credit card over the phone with Shopify POS?
Yes, if your payment provider and device support manual entry: at checkout, tap Manual card entry, type the card details and tap Charge. Shopify warns that manual entry carries extra fraud risk, and Shopify Payments charges keyed payments at a different rate from in-person ones. For phone orders, Shopify suggests sending a draft-order invoice instead.
Is it safer to send a payment link than to take card details over the phone?
For the card details, yes: the customer types them into Shopify’s checkout, so your staff never hear them, and supported cards can use 3D Secure. Shopify’s help center suggests a draft-order invoice for telephone orders.
Can staff write down a customer’s card number to put through later?
They shouldn’t. Shopify advises never keeping card numbers on paper, in spreadsheets or in email, and the card industry’s data security standard applies to any business that handles card data, even once. Type the card straight into Shopify while the customer is on the line, or send them a checkout link.
How do I stop staff typing card numbers into Shopify POS?
On each device, go to Settings > Payments > Payment options and turn off Allow manual credit card entry (this needs the Manage payment settings for device permission). A device can switch off an option your store-wide default allows but can’t switch on one the default leaves out, so check each device. In the admin, limit the Charge credit card staff permission.
Who pays if a card payment taken over the phone turns out to be fraud?
With card-not-present payments, the merchant generally bears the loss and must show the sale was legitimate. A chargeback takes the disputed amount right away, and Shopify Payments adds a fee that’s returned if you win. On a link, supported cards can use 3D Secure, and an eligible authenticated payment shifts fraud liability to the card issuer.

Read next

About Pay Link